Re: Linux System Users Login/Password?

Vincent Pirez wrote:
Hi,

Has anyone managed to code anything that will verify the username and password of a user against the /etc/shadow file?

I need to authenticate users based on their local system accounts, but unfortunately need to do this without recompiling PHP or Apache with custom modules.

So far I've managed to pull all of the shadow password strings out and into a database, but is there any way of 'matching' the encrypted strings if you are given the plain text version, like with md5?

Thanks in advance,
Vince.


PHP has a function named 'crypt' that will encrypt strings in the same way the password is encrypted into the password file. It takes a password string and a salt string.

The encryption algorithm may vary but is typically either a two character salt (CRYPT_STD_DES) or an MD5 salt (CRYPT_MD5). The MD5 encryptions are guaranteed to start with a '$' sign.

So, for example, let's say your shadow entry is:
web:$2$Hlpmlp9i$5VnapGyOuIzJFkPcrvE7a.:13007:0:99999:7:::

This is a MD5 encrypted password.

if( crypt($password, $salt) == '$2$Hlpmlp9i$5VnapGyOuIzJFkPcrvE7a.')) {
// password is correct
}

Do you really want to pull all the shadow entries into a database? Why not read the file directly and explode() the entries? It seems to me that you will have synchronization issues the other way.

-david-

.

Relevant Pages

  • Re: Cryptographic protocols, again
    ... decrypted (to prove that I really did encrypt all thirty-six dice rolls). ... Server picks from a random set of strings ... Encrypt the 36 strings with your own private key AND ...
    (rec.games.backgammon)
  • Re: Cross platform password string encryption
    ... few people use Delphi or C# compared to C ... The consuming code doesn't use the library code in the right way. ... a raw key directly to the encrypt routine. ... The consuming code is trying to pass strings to the routines and ...
    (sci.crypt)
  • Re: One-Time Pads [was: Re: Help: Randomizing a List of Numbers]
    ... > never repeat the use of one of those strings then throw away the key. ... Checking my home machine, I see the following: ... if I were to use a one-time pad to encrypt traffic ... A CD a month, or even a CD a week, would not be a distribution nightmare. ...
    (sci.crypt)
  • Re: Newbie data size encryption questions
    ... amount of data that I can encrypt without the system being insecure? ... For example, if i wanted to encrypts strings of say 5 or 10 characters, ... bytes for AES] and other modes like CTR would need an IV. ...
    (sci.crypt)
  • Re: Storing connection strings
    ... An answer will depend heavily on who you are trying to protect it from, ... might also encrypt the key value. ... again perhaps encrypted and the keys protected by ACLs. ... Search for "COM+ Object Constructor Strings". ...
    (microsoft.public.vb.database)